CVE-2024-7327

Summary

CVE-2024-7327 is a critical vulnerability identified in Xinhu RockOA 2.6.2. The issue lies in the function dataAction of the file /webmain/task/openapi/openmodhetongAction.php, which is susceptible to SQL injection. An attacker can exploit this remotely by manipulating the argument nickName. The vulnerability, identified as VDB-273250, has been disclosed to the public and may already be in use. Despite early notification, the vendor has not responded to the disclosure.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.